toc:true

As a user in Codefresh, you must authorize access to your Git provider accounts, and authenticate Git-based actions from Codefresh clients, per provisioned GitOps Runtime. This is done through the Git user token, which is an access token unique to each user. For more details, including required scopes and how the Git user token differs from the Git Runtime token, see[Git tokens in Codefresh]({{site.baseurl}}/docs/security/git-tokens/).

As a user in Codefresh, you must authorize access to your Git provider accounts and authenticate Git-based actions from Codefresh clients, per provisioned GitOps Runtime. This is done through the Git user token, which is an access token unique to each user. For more details, including required scopes and how the Git user token differs from the Git Runtime token, see[Git tokens in Codefresh]({{site.baseurl}}/docs/security/git-tokens/).

The authorization mode depends on the authorization method set up by your account admin:

* OAuth2

If your admin has set up authentication with OAuth2, you can authorize access using OAuth2.

* Git user access token

You can always generate a Git user token from your Git provider and then add the same to the GitOps Runtime in Codefresh to authorize access.

Codefresh GitOps does not officially support fine-grained tokens, or tokens with custom scopes. If you are using such tokens, make sure you turn off validation for Git tokens in the`values.yaml` file, as described in[Skipping token values.yaml]({{site.baseurl}}/docs/security/git-tokens#skipping-token-validation-in-valuesyaml).

Authorize Git access to GitOps Runtimes with OAuth2 if your account admin has set up Codefresh as an OAuth application, or alternatively through Git user access tokens from your Git provider.

If you have access to more than one GitOps Runtime in the same or in different accounts, you can use the same Git user token for all the Runtimes you have access to._You must however authorize access for each GitOps Runtime individually_.

{: .table .table-bordered .table-hover}

|**Setting**|**Validation**|

| --------------| --------------|

|**userToken**|If explicitly defined, or defined as a`secretKeyRef` which exists in the currentk8s context and the defined namespace.|

|**userToken**|If explicitly defined, or defined as a`secretKeyRef` which exists in the currentK8s context and the defined namespace.|

|**Account permissions**|If the user has admin permissions for the account in which they are installing the runtime.|

|**Runtime name**|If defined, and is unique to the account.|

|**Access mode**|{::nomarkdown}<ul><li>For tunnel-based (the default), if <codeclass="highlighter-rouge">accountId</code> is defined, and matches the account of the <codeclass="highlighter-rouge">userToken</code> defined in the file.</li><li>For ingress-based, if the hosts array contains at least one entry that is a valid URL (successful HTTP GET).</li><li>If both tunnel-based and ingress-based access modes are disabled, if <codeclass="highlighter-rouge">runtime.ingressUrl</code> is defined.</li></ul>{:/}|

You may want to disable automated validation for specific scenarios, such as to address false-negatives.

Do so by either adding the flag to the Helm install command or adding the relevant section to the values file.

Do so by either adding the flag to the Helm install command or adding the relevant section to the`values` file.

{% endraw %}

{% endhighlight %}

If you use tokens with custom scopes, or GitHub's fine-grained tokens (currently not officially supported by Codefresh),_skip token validation_ to avoid validation failures when installing GitOps Runtimes.

Add the`skipGitPermissionValidation` flag to your`values.yaml` file:

app-proxy:

config:

skipGitPermissionValidation:"true"

To manually validate the values file, run:

Codefresh requires two types of Git tokens for authentication in GitOps, a Git Runtime token, and a Git user token. The Runtime and user tokens are both Git access tokens used for different purposes. See[Git Runtime tokens versus Git user tokens in Codefresh](#git-runtime-tokens-versus-git-user-tokens-in-codefresh) and[Interaction between Git tokens and secrets](#interaction-between-git-tokens-and-secrets).

Codefresh requires two types of Git tokens for authentication in GitOps, a Git Runtime token, and a Git user token. The Runtime and user tokens are both Git access tokens used for different purposes. See[Git Runtime tokens versus Git user tokens in Codefresh](#git-runtime-tokens-versus-git-user-tokens-in-codefresh).

* The[Git Runtime token](#git-runtime-token-scopes) is mandatory for every GitOps Runtime. It must be provided during the Runtime installation, and is typically associated with a service/robot account.

* The[Git user token](#git-user-access-token-scopes) is an access token that is unique to every user in the Codefresh platform. It is required after installation for every Runtime which the user has access to.

At all times,_bothtokens are always securely stored on your cluster_ and never stored locally on our platform.

_Bothtokens are always securely stored on your cluster_ and never locally on our platform.

Users can also create and use Git tokens with custom scopes for both GitOps Runtimes and for Git repositories associated with the Runtimes that they need to access. See[Git user tokens with custom scopes](#git-user-tokens-with-custom-scopes).

| Managed by| Admin at account-level| User|

| Associated Account Type| (Recommended)[Service account or robot account](#use-a-servicerobot-account-for-gitops-runtimes)| User account|

Codefresh needs access to Git repositories for reading and writing to configuration and resource manifests. This section elaborates on how Git providers and repositories with Git tokens for authentication to .

You also have the option to directly add your Git Runtime token, or a reference to the secret that contains the Runtime secret, to`values.yaml` (typically the latter).

You can directly add the Git Runtime token, or a reference to the Runtime secret, to your`values.yaml`.

To skip token validation both during installation and upgrade in this scenario, add the`skipValidation` flag to`values.yaml`.

Add the `skipGitPermissionValidation` flag to your `values.yaml` file to bypass token validation:

If you set this flag, make sure that: